provider capability model, on-demand scan/backfill, more providers

Readability capabilities (exists/object_readable/listable) are now tracked
separately instead of a single exposure flag, matching how providers differ:
- Azure 'Blob' mode = object readable, not listable; 'Container' = listable
- Cloudflare R2 public URLs are never anonymously listable (root 500); R2 is
  object-read only and is no longer probed for listing
- S3/GCS: 200 list = listable; 403 + readable index.html/robots.txt =
  object readable only
New columns: cloud_assets.listable, cloud_assets.object_readable.

Azure: account-level container listing is never anonymous; discover containers
by probing a bounded common-name set (or the container from a URL path), then
list blobs.

Classifier: added the legacy AWS '.s3-<region>.amazonaws.com' bucket form.

On-demand scan: POST /api/scan {target} classifies a host or URL, follows CNAME
for custom domains, probes, and indexes readable resources; Azure container
comes from the URL path. UI has a Scan box.

Backfill: POST /api/reprobe re-probes already-discovered assets with the current
checks and indexes any readable ones, recovering findings from earlier probes.

DNS: CNAME-only enrichment (A/AAAA resolved only for matches), 64 workers,
larger queue.

Verified live against real public resources:
  veteran1.nyc3.digitaloceanspaces.com            listable, entries
  bucket-01.s3-eu-west-1.amazonaws.com            listable, entries
  tartugeo-podcast.storage.googleapis.com         listable, entries
  eroticfeeldev.blob.core.windows.net/images      listable, entries

internal/config/config.go

@@ -60,7 +60,7 @@ func Load() (*Config, error) {
 		DatabaseURL:      os.Getenv("DATABASE_URL"),
 		DBMaxConns:       envInt("DB_MAX_CONNS", 8),
 		DNSServers:       envList("DNS_SERVERS", nil),
-		DNSWorkers:       envInt("DNS_WORKERS", 16),
+		DNSWorkers:       envInt("DNS_WORKERS", 64),
 		DNSTimeout:       envDuration("DNS_TIMEOUT", 5*time.Second),
 		DNSCacheSize:     envInt("DNS_CACHE_SIZE", 1<<18),
 		DedupSize:        envInt("DEDUP_SIZE", 1<<18),
@@ -68,7 +68,7 @@ func Load() (*Config, error) {
 		DNSPositiveTTL:   envDuration("DNS_POSITIVE_TTL", 10*time.Minute),
 		DNSNegativeTTL:   envDuration("DNS_NEGATIVE_TTL", 1*time.Minute),
 		DirectQueueSize:  envInt("DIRECT_QUEUE_SIZE", 8192),
-		DNSQueueSize:     envInt("DNS_QUEUE_SIZE", 65536),
+		DNSQueueSize:     envInt("DNS_QUEUE_SIZE", 262144),
 		DBQueueSize:      envInt("DB_QUEUE_SIZE", 8192),
 		DBBatchSize:      envInt("DB_BATCH_SIZE", 500),
 		DBFlushInterval:  envDuration("DB_FLUSH_INTERVAL", 2*time.Second),

internal/config/config_test.go

@@ -14,7 +14,7 @@ func TestLoadDefaults(t *testing.T) {
 	if c.DatabaseURL != "postgres://localhost/ctcloud" {
 		t.Fatalf("database url = %q", c.DatabaseURL)
 	}
-	if c.DNSWorkers != 16 || c.DNSMaxCNAMEdepth != 8 {
+	if c.DNSWorkers != 64 || c.DNSMaxCNAMEdepth != 8 {
 		t.Fatalf("unexpected DNS defaults: %+v", c)
 	}
 	if c.ActiveProbing {